How to make sure K8S nodes only communicate via private network

General Discussions
,
1

I have the following setup:

master and worker node are connected via eth0 to the internet and via enp7s0 to a local newtork (IP’s 10.0.0.2 and 10.0.0.3).
I have installed K8S with flannel as networking layer.

Question: 1) How can I know that all communication between the nodes is going through the local network and not through the internet? 1b) When an Ingress is queried from the internet via the IP of the master node - is the traffic also routed through the local network, back to the client through the master node? 2) How do make sure - if not already - that everything stays in the local net?

master node:

root@master-0:~# ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 96:00:00:9f:3f:4b brd ff:ff:ff:ff:ff:ff
    inet <EXTERNAL_IP>/32 brd <EXTERNAL_IP> scope global dynamic eth0
       valid_lft 62620sec preferred_lft 62620sec
    inet <EXTERNAL_IP_2>/32 scope global eth0:1
       valid_lft forever preferred_lft forever
    inet6 <EXTERNAL_IP>/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 <EXTERNAL_IP>/64 scope link 
       valid_lft forever preferred_lft forever
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 86:00:00:9f:3f:53 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.2/32 brd 10.0.0.2 scope global dynamic enp7s0
       valid_lft 48369sec preferred_lft 48369sec
    inet6 fe80::8400:ff:fe9f:3f53/64 scope link 
       valid_lft forever preferred_lft forever
4: flannel.1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default 
    link/ether e6:60:af:a3:b8:e7 brd ff:ff:ff:ff:ff:ff
    inet 10.244.0.0/32 brd 10.244.0.0 scope global flannel.1
       valid_lft forever preferred_lft forever
    inet6 fe80::e460:afff:fea3:b8e7/64 scope link 
       valid_lft forever preferred_lft forever
5: cni0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default qlen 1000
    link/ether 26:16:13:26:e6:71 brd ff:ff:ff:ff:ff:ff
    inet 10.244.0.1/24 brd 10.244.0.255 scope global cni0
       valid_lft forever preferred_lft forever
    inet6 fe80::2416:13ff:fe26:e671/64 scope link 
       valid_lft forever preferred_lft forever
[...]

worker node:

root@worker-0:~# ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet <EXTERNAL_IP>/32 brd <EXTERNAL_IP> scope global dynamic eth0
       valid_lft 50209sec preferred_lft 50209sec
    inet6 <EXTERNAL_IP>/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 <EXTERNAL_IP>/64 scope link 
       valid_lft forever preferred_lft forever
3: enp7s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 86:00:00:9f:53:ed brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.3/32 brd 10.0.0.3 scope global dynamic enp7s0
       valid_lft 76309sec preferred_lft 76309sec
    inet6 fe80::8400:ff:fe9f:53ed/64 scope link 
       valid_lft forever preferred_lft forever
4: flannel.1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default 
    link/ether 6e:57:f1:9a:8b:30 brd ff:ff:ff:ff:ff:ff
    inet 10.244.1.0/32 brd 10.244.1.0 scope global flannel.1
       valid_lft forever preferred_lft forever
    inet6 fe80::6c57:f1ff:fe9a:8b30/64 scope link 
       valid_lft forever preferred_lft forever
5: cni0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default qlen 1000
    link/ether c6:fa:16:f2:e7:67 brd ff:ff:ff:ff:ff:ff
    inet 10.244.1.1/24 brd 10.244.1.255 scope global cni0
       valid_lft forever preferred_lft forever
    inet6 fe80::c4fa:16ff:fef2:e767/64 scope link 
       valid_lft forever preferred_lft forever
[...]